feat(manifest): export digest-bound contribution evidence

[morluto]

Description

Contribution preparation could export evidence and readiness separately, but it had no stable artifact tying those claims to the exact candidate workspace. A validation at the same Git HEAD could remain apparently current after staged, unstaged, untracked, ignored, or submodule state changed.

This adds an in-toto Statement v1 envelope around a product-owned contribution evidence predicate. The manifest binds repository and opportunity identity, a bounded managed-workspace snapshot, selected validation execution contracts, evidence freshness, readiness, exact stored pull-request facets, and prepared-draft references. Missing, stale, unparseable, truncated, or incompatible inputs remain explicit gaps instead of becoming passing claims.

Workspace snapshots cover HEAD, staged and unstaged binary patches, bounded untracked content, submodules, changed files, and commit summaries. Ignored or otherwise unbound content makes the snapshot incomplete. Candidate validation runs save pre/post snapshot digests; manifest completeness uses the newest run per definition and run kind while retaining older runs as history.

Manifest generation is local-only. It reads SQLite, may run non-mutating Git commands for a selected managed workspace, persists the digest-validated statement, and never refreshes GitHub. CLI and MCP callers must explicitly sync exact PR facets first when current checks or reviews matter. Drafts store an optional manifest ID as structured metadata without copying its claims into public prose.

Closes #113.

Suggested review order

1. internal/workspace/snapshot.go and validation binding in internal/app/evidence.go.
2. internal/manifest/models.go, the migration, and corpus persistence.
3. internal/app/manifest.go for completeness, freshness, and identity rules.
4. CLI/MCP adapters, regression tests, and architecture documentation.

The branch is split into four semantic commits: snapshot binding, manifest core/persistence, transport/documentation wiring, and adapter extraction.

Testing

• make verify
• make test-race
• Windows cross-compilation for workspace, manifest, corpus, app, CLI, and MCP packages
• Regression coverage for deterministic identity, tamper rejection, same-HEAD untracked changes, ignored content, superseded validation failures, partial PR facets, identity mismatch, and persisted round trips

Compatibility and scope

• Storage and side-effect invariants remain intact
• No unrelated cleanup or generated-output churn is included

Existing corpora require the explicit backed-up migration flow. No GitHub mutation or hidden network access is added.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.